[Xorp-users] Re: Newbie Xorp & m'cast problem

[Dan Lukes]

>> [ 2005/06/07 17:29:02  ERROR xorp_fea:16848 MFEA +1340 
>> mfea_proto_comm.cc proto_socket_read ] proto_socket_read() failed: 
>> invalid unicast sender address: 0.0.0.0
> 
> Those "invalid unicast sender address: 0.0.0.0" messages are odd.
> Do you run a sender or a receiver on the same box as the XORP
> router?
> In any case, please run tcpdump on all network interfaces and try to
> catch if there are any IP packets that have indeed source address of
> 0.0.0.0.

	I had a very large TCPDUMP with several packets sourced from 0.0.0.0

	I deleted it already, but if I remember correctly, the suspicious 
packets has been IGMP leave messages sent to ALL-ROUTERS GROUP.

	I have the only example of it now:

00:28:51.713070 0.0.0.0 > ALL-ROUTERS.MCAST.NET: igmp leave 227.11.22.33 
[tos 0xc0]  [ttl 1]

	I have no MAC so I don't know the exact source of it.

	They sems to be sent sometime by hosts which lost the IP (DHCP renewal 
expired, for example) or shutting down.

	There are seems not to be reason to ignore IGMP from this source unless 
we are hesitate about the forged leave messages.

	Well, it may not help to analyse Mark's problem too much, but it's 
information that IGMP message from 0.0.0.0 may not be rare.

						Dan